#hoopla

After moving a Drupal 6 installation (database and files), on the new hosting, the Drupal installation screen appeared instead of the copied site. In order to complete the movement, the sites/default/files folder and its contents need to be writable by the www-data group.

When doing a routine backup of my Ubuntu workstation, I was wondering why it took so long. rsync tried to copy the following 25 PB file from my harddisk:

NOW I know, why Chromium is so much faster than other browsers: It simply copies the web on the harddisk... ;-)

Btw: The file disappeared shortly after. Maybe ext4 found the mistake...

Japanese Yen cannot have any decimals. If another currency is the standard currency, decimals can occur when converting the prices. To selectively round the Yen-converted prices with zero decimals, Currency.php has to be copied to the local code folder and edited as described in the forum.

Today I found one customer Typo3 website that would arbitrarily deliver white pages or pages without layout and menu. Each page had a "End HTML 3.51.197" in comment brackets attached that I never noticed before.

Digging into the problem, I found strange code in typo3conf/localconf.php. It looked like "error_reporting(0);eval(base64_decode('JGxMOXdGMW[...]));"

Deactivating the code solved the visible problems on the website. In order to prevent the site from being comprimised further, I changed all logins, made localconf.php read-only for the webserver user and deactivated the eval function in PHP, which is not in use anyway.

The interesting questions are:

1. How did this code get there?
2. What did it do or try to do?

The first question is hard to answer: I think, the hacker got the login somehow, maybe fished from a computer with malware on it. Within the backend, any user with administrative rights can change localconf. Another possibility would be that a vulnerable plugin was used for this.

For the second question, let's go for the code: You can download it under "more". This hack seems to be related to a wordpress hack. The code contains the string "HOSTING VASH NE PODDERZHIVAET ETO". If you google for it, there are some posts to that, for example http://blog.lauralemay.com/2012/01/hacked.html.

So I guess the purpose of this is to present spam links to search engines and users that have a search engine as referrer.

Bei einem Kunden trat plötzlich immer beim Start von Outlook von allen Clients aus eine Fehlermeldung auf, dass ein Zertifikat ungültig sei. Da er auf einem Cloud-gehosteten Exchange von Office 365 arbeitet, kann dies eigentlich nicht sein. Merkwürdig war, dass der Fehler sich auf ein Zertifikat von Host Europe bezog, das ausschließlich auf der Webseite verwendet wird und damit in keiner Beziehung zu Outlook steht. Tatsächlich war das Zertifikat, das für die SSL-gesicherte Webseite verwendet wurde, abgelaufen.

Outlook nutzt den Microsoft Autodiscover-Service, der automatisch auf die Adresse https://<smtp-address-domain>/autodiscover/autodiscover.xml zurückgreift (siehe Technet). Sehen kann man dieses Verhalten unter anderem in den Apache-Logs: POST /autodiscover/autodiscover.xml HTTP/1.1" 301 253 "-" "Microsoft Office/14.0 (Windows NT 6.1; Microsoft Outlook 14.0.6112; Pro)

Solange das Zertifikat gültig ist, gibt es damit kein Problem.